Security Researchers Flag XSS Exploits in Popular WordPress Plugins

Security analysts have identified a coordinated campaign that leverages stored cross‑site scripting (XSS) flaws in two widely used WordPress extensions—Ninja Forms and WPC Product Bundles for WooCommerce—to plant backdoors and create unauthorized administrator accounts on compromised sites.

Stored XSS allows malicious code to be saved on a server and later executed in the browser of anyone who views the affected page. In the case of these plugins, the vulnerability resides in input fields that insufficiently sanitize user‑supplied data, enabling an attacker to embed script payloads that run whenever an administrator accesses the plugin’s settings or form editor.

Ninja Forms, a drag‑and‑drop form builder, powers thousands of contact, survey and registration forms across the WordPress ecosystem. WPC Product Bundles for WooCommerce, meanwhile, adds bundling capabilities to the dominant e‑commerce platform. Both plugins enjoy high download counts and are frequently installed on sites ranging from small blogs to large online stores, making them attractive vectors for mass exploitation.

Exploitation reports indicate that once the malicious script is triggered, it can silently inject a PHP backdoor into the site’s file system and then create a hidden admin user with full privileges. This gives threat actors the ability to modify site content, harvest visitor data, or further pivot to other systems hosted on the same server. Because the attack chain relies on legitimate plugin functionality, it can evade many standard security scanners that focus on known malware signatures.

The developers of both extensions have responded by releasing patches that tighten input validation and implement additional nonce checks. They have urged site owners to apply the updates immediately, reset any newly created administrator credentials, and review their user lists for unknown accounts. WordPress’s core team also reminded users that keeping the core platform, themes and all plugins up to date remains the most effective defense against such attacks.

The incident underscores a broader challenge for the WordPress community: the sheer number of third‑party plugins creates a large attack surface, and not all maintainers can respond to security disclosures with the speed required to protect a global user base. Security experts recommend regular vulnerability scanning, employing a web‑application firewall, and limiting plugin installations to those that are actively maintained and widely reviewed. As the ecosystem continues to grow, coordinated efforts between developers, hosting providers and end users will be essential to mitigate future XSS‑based intrusion campaigns.